Add trusted auto-approval migration inventory

tests/test_trusted_auto_approval_migration.py

@@ -0,0 +1,65 @@
+from repo_registry.core.service import RegistryService
+from repo_registry.repo_ingestion.git import GitIngestionService
+from repo_registry.storage.sqlite import RegistryStore
+
+
+def make_service(tmp_path):
+    store = RegistryStore(tmp_path / "registry.sqlite3")
+    store.initialize()
+    return RegistryService(store, ingestion=GitIngestionService(tmp_path / "checkouts"))
+
+
+def write_api_repo(tmp_path):
+    source = tmp_path / "api-repo"
+    source.mkdir()
+    (source / "README.md").write_text("# API Repo\nReports health.\n", encoding="utf-8")
+    (source / "app.py").write_text('@app.get("/health")\ndef health():\n    return {}\n', encoding="utf-8")
+    return source
+
+
+def test_trusted_auto_approval_requires_explicit_migration_mode(tmp_path):
+    service = make_service(tmp_path)
+    repository = service.register_repository(
+        name="Legacy Guard Repo",
+        url=str(write_api_repo(tmp_path)),
+    )
+    summary = service.analyze_repository(repository.id, use_llm_assistance=False)
+
+    try:
+        service.trusted_auto_approve_candidate_graph(
+            repository.id,
+            summary.analysis_run.id,
+        )
+    except ValueError as exc:
+        assert "deprecated" in str(exc)
+    else:
+        raise AssertionError("trusted auto-approval should be guarded by default")
+
+    assert service.ability_map(repository.id).abilities == []
+
+
+def test_legacy_auto_approval_inventory_identifies_review_debt(tmp_path):
+    service = make_service(tmp_path)
+    repository = service.register_repository(
+        name="Legacy Inventory Repo",
+        url=str(write_api_repo(tmp_path)),
+    )
+    summary = service.analyze_repository(repository.id, use_llm_assistance=False)
+
+    service.trusted_auto_approve_candidate_graph(
+        repository.id,
+        summary.analysis_run.id,
+        notes="Historical migration replay.",
+        allow_deprecated_migration_mode=True,
+    )
+
+    records = service.list_trusted_auto_approval_migration_records()
+    assert len(records) == 1
+    record = records[0]
+    assert record.repository_id == repository.id
+    assert record.repository_name == "Legacy Inventory Repo"
+    assert record.analysis_run_id == summary.analysis_run.id
+    assert record.review_decision_id > 0
+    assert record.analysis_run_status == "completed"
+    assert record.current_approved_ability_count == 1
+    assert "rebuild" in record.recommended_next_step